CVE-2026-24740 Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access
Attackers with restricted label access can bypass controls to gain root shell access in out-of-scope Docker containers on the same host.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24740?
CVE-2026-24740 is a high-severity missing authorization vulnerability in amir20 dozzle, published on 27 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters (for example, `label=env=dev`) to obtain an interactive root shell in out‑of‑scope containers (for example, `env=prod`) on the same agent host by directly targeting their container IDs. Version 9.0.3 contains a patch for the issue.
Which versions are affected by CVE-2026-24740?
3 open source packages ship an affected version, including github.com/amir20/dozzle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/amir20/dozzle Go | All versions | 1.29.1-0.20260125230338-620e59aa2463 |
github.com/amir20/dozzle Go | All versions | 1.29.1-0.20260125230338-620e59aa2463 |
github.com/amir20/dozzle Go | All versions | 1.29.1-0.20260125230338-620e59aa2463 |
Products include Amirraminfar Dozzle.
How do I fix CVE-2026-24740?
Upgrade github.com/amir20/dozzle to 1.29.1-0.20260125230338-620e59aa2463 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-24740 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24740 exists.
Other vulnerabilities in amir20 dozzle
Sources
Also known as GHSA-m855-r557-5rc5, GO-2026-4380.